CVE-2021-43176: Path Traversal
The GOautodial API prior to commit 3c3a979 made on October 13th, 2021 takes a user-supplied “action” parameter and appends a .php file extension to locate and load the correct PHP file to implement the API call. Vulnerable versions of GOautodial do not sanitize the user input that specifies the action. This permits an attacker to execute any PHP source file with a .php extension that is present on the disk and readable by the GOautodial web server process. Combined with CVE-2021-43175, it is possible for the attacker to do this without valid credentials. CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-43176?
CVE-2021-43176 has a medium severity rating due to the potential for remote code execution if exploited.
How do I fix CVE-2021-43176?
To mitigate CVE-2021-43176, ensure you update to the latest version of GOautodial that addresses this vulnerability.
What are the affected versions for CVE-2021-43176?
CVE-2021-43176 affects versions prior to commit 3c3a979 for GOautodial API and versions 4 for GOautodial.
What kind of attacks can CVE-2021-43176 lead to?
CVE-2021-43176 can potentially allow attackers to execute arbitrary PHP code on the server.
Is CVE-2021-43176 easy to exploit?
CVE-2021-43176 is considered to be easily exploitable due to the lack of input sanitization in the affected software.